aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8

Analysis

max time kernel
32s
max time network
109s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 21:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Size

85KB
MD5

a0883f175ba0c5b3e9e340583654dc86
SHA1

197ffda4ee2ff5fce76e3ee30bfc9fd0583b4708
SHA256

aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8
SHA512

36a1b2d9a120e17b86b9d9992611fdbefdd9adef08bdb450714bb5e363fa90675a7abb3fc269543273a9fc26ba00b76625f61f13bdc7ecbfd2da754893c23036
SSDEEP

1536:NHsxFJfgaDjofVKn1pGwTJOlw1UrcFwlb:NM1JDSAOwECR2b

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	Tiwi.exe

Modifies system executable filetype association 2 TTPs 59 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe

Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Tiwi.exe

Disables RegEdit via registry modification 5 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	imoet.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 5 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 15 IoCs

pid	Process
1492	Tiwi.exe
1052	IExplorer.exe
1908	Tiwi.exe
1764	IExplorer.exe
888	winlogon.exe
748	Tiwi.exe
1896	Tiwi.exe
1140	IExplorer.exe
1616	IExplorer.exe
392	imoet.exe
1176	winlogon.exe
2032	cute.exe
1096	Tiwi.exe
1608	imoet.exe
1720	imoet.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1188-56-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0006000000014145-59.dat	upx
behavioral1/files/0x0006000000014257-63.dat	upx
behavioral1/files/0x0006000000014257-64.dat	upx
behavioral1/files/0x0006000000014257-66.dat	upx
behavioral1/files/0x0006000000014156-74.dat	upx
behavioral1/files/0x0006000000014145-73.dat	upx
behavioral1/files/0x00060000000143a4-72.dat	upx
behavioral1/files/0x00060000000142db-71.dat	upx
behavioral1/files/0x000600000001434d-70.dat	upx
behavioral1/files/0x00060000000142ce-69.dat	upx
behavioral1/files/0x00060000000142c6-77.dat	upx
behavioral1/files/0x000600000001420d-75.dat	upx
behavioral1/files/0x0006000000014257-78.dat	upx
behavioral1/files/0x000600000001422f-76.dat	upx
behavioral1/files/0x0006000000014145-82.dat	upx
behavioral1/memory/1908-84-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1052-89-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0006000000014257-90.dat	upx
behavioral1/memory/1492-88-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0006000000014257-85.dat	upx
behavioral1/files/0x0006000000014257-83.dat	upx
behavioral1/memory/1764-92-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x00060000000142ce-93.dat	upx
behavioral1/files/0x00060000000142ce-96.dat	upx
behavioral1/files/0x00060000000142db-97.dat	upx
behavioral1/files/0x0006000000014156-99.dat	upx
behavioral1/files/0x0006000000014145-136.dat	upx
behavioral1/files/0x00060000000142ce-133.dat	upx
behavioral1/files/0x00060000000142c6-130.dat	upx
behavioral1/files/0x000600000001434d-129.dat	upx
behavioral1/files/0x0006000000014156-127.dat	upx
behavioral1/files/0x000600000001422f-126.dat	upx
behavioral1/files/0x0006000000014145-139.dat	upx
behavioral1/files/0x00060000000143a4-125.dat	upx
behavioral1/files/0x00060000000142db-124.dat	upx
behavioral1/files/0x00060000000142c6-123.dat	upx
behavioral1/files/0x000600000001434d-122.dat	upx
behavioral1/files/0x000600000001422f-121.dat	upx
behavioral1/files/0x000600000001420d-120.dat	upx
behavioral1/files/0x0006000000014156-119.dat	upx
behavioral1/files/0x00060000000142ce-117.dat	upx
behavioral1/files/0x00060000000142db-115.dat	upx
behavioral1/files/0x00060000000142c6-114.dat	upx
behavioral1/files/0x000600000001422f-113.dat	upx
behavioral1/files/0x000600000001420d-112.dat	upx
behavioral1/files/0x0006000000014156-111.dat	upx
behavioral1/files/0x000600000001434d-110.dat	upx
behavioral1/files/0x00060000000142c6-109.dat	upx
behavioral1/files/0x000600000001422f-108.dat	upx
behavioral1/files/0x000600000001420d-107.dat	upx
behavioral1/files/0x0006000000014156-106.dat	upx
behavioral1/files/0x00060000000143a4-105.dat	upx
behavioral1/files/0x00060000000142db-104.dat	upx
behavioral1/files/0x00060000000142c6-103.dat	upx
behavioral1/files/0x000600000001422f-102.dat	upx
behavioral1/files/0x000600000001420d-101.dat	upx
behavioral1/files/0x00060000000143a4-98.dat	upx
behavioral1/files/0x000600000001434d-94.dat	upx
behavioral1/memory/888-144-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1188-145-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1764-151-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1896-159-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/748-158-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Loads dropped DLL 20 IoCs

pid	Process
1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
1492	Tiwi.exe
1492	Tiwi.exe
1492	Tiwi.exe
1492	Tiwi.exe
1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
1052	IExplorer.exe
1052	IExplorer.exe
1492	Tiwi.exe
1492	Tiwi.exe
1052	IExplorer.exe
1052	IExplorer.exe
1492	Tiwi.exe
1492	Tiwi.exe
1052	IExplorer.exe
1052	IExplorer.exe
1052	IExplorer.exe
1052	IExplorer.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	Tiwi.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	IExplorer.exe
File opened (read-only)	\??\N:	IExplorer.exe
File opened (read-only)	\??\R:	IExplorer.exe
File opened (read-only)	\??\W:	IExplorer.exe
File opened (read-only)	\??\F:	Tiwi.exe
File opened (read-only)	\??\S:	Tiwi.exe
File opened (read-only)	\??\V:	Tiwi.exe
File opened (read-only)	\??\J:	IExplorer.exe
File opened (read-only)	\??\M:	IExplorer.exe
File opened (read-only)	\??\Q:	IExplorer.exe
File opened (read-only)	\??\U:	IExplorer.exe
File opened (read-only)	\??\B:	Tiwi.exe
File opened (read-only)	\??\E:	Tiwi.exe
File opened (read-only)	\??\K:	Tiwi.exe
File opened (read-only)	\??\O:	Tiwi.exe
File opened (read-only)	\??\E:	IExplorer.exe
File opened (read-only)	\??\H:	IExplorer.exe
File opened (read-only)	\??\I:	IExplorer.exe
File opened (read-only)	\??\G:	Tiwi.exe
File opened (read-only)	\??\J:	Tiwi.exe
File opened (read-only)	\??\T:	Tiwi.exe
File opened (read-only)	\??\Y:	Tiwi.exe
File opened (read-only)	\??\Z:	Tiwi.exe
File opened (read-only)	\??\F:	IExplorer.exe
File opened (read-only)	\??\O:	IExplorer.exe
File opened (read-only)	\??\M:	Tiwi.exe
File opened (read-only)	\??\N:	Tiwi.exe
File opened (read-only)	\??\G:	IExplorer.exe
File opened (read-only)	\??\K:	IExplorer.exe
File opened (read-only)	\??\L:	Tiwi.exe
File opened (read-only)	\??\L:	IExplorer.exe
File opened (read-only)	\??\S:	IExplorer.exe
File opened (read-only)	\??\T:	IExplorer.exe
File opened (read-only)	\??\X:	IExplorer.exe
File opened (read-only)	\??\Y:	IExplorer.exe
File opened (read-only)	\??\I:	Tiwi.exe
File opened (read-only)	\??\P:	Tiwi.exe
File opened (read-only)	\??\X:	Tiwi.exe
File opened (read-only)	\??\P:	IExplorer.exe
File opened (read-only)	\??\V:	IExplorer.exe
File opened (read-only)	\??\H:	Tiwi.exe
File opened (read-only)	\??\Q:	Tiwi.exe
File opened (read-only)	\??\R:	Tiwi.exe
File opened (read-only)	\??\U:	Tiwi.exe
File opened (read-only)	\??\W:	Tiwi.exe
File opened (read-only)	\??\Z:	IExplorer.exe

Modifies WinLogon 2 TTPs 15 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	cute.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	Tiwi.exe
File opened for modification	C:\autorun.inf	Tiwi.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	Tiwi.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	imoet.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	cute.exe
File created	C:\Windows\SysWOW64\tiwi.scr	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	cute.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	imoet.exe
File created	C:\Windows\SysWOW64\shell.exe	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	winlogon.exe
File opened for modification	C:\Windows\tiwi.exe	imoet.exe
File created	C:\Windows\tiwi.exe	imoet.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	Tiwi.exe
File created	C:\Windows\tiwi.exe	IExplorer.exe
File created	C:\Windows\tiwi.exe	cute.exe
File opened for modification	C:\Windows\tiwi.exe	Tiwi.exe
File created	C:\Windows\tiwi.exe	winlogon.exe
File opened for modification	C:\Windows\tiwi.exe	cute.exe
File opened for modification	C:\Windows\tiwi.exe	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 49 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Tiwi"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Tiwi"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\SwapMouseButtons = "1"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Tiwi"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\SwapMouseButtons = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Tiwi"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Tiwi"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\SwapMouseButtons = "1"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Tiwi"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Tiwi"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\SwapMouseButtons = "1"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\SwapMouseButtons = "1"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	imoet.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	Tiwi.exe

Modifies Internet Explorer start page 1 TTPs 5 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	cute.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
1492	Tiwi.exe
1052	IExplorer.exe
1764	IExplorer.exe
888	winlogon.exe
748	Tiwi.exe
1896	Tiwi.exe
1140	IExplorer.exe
1616	IExplorer.exe
392	imoet.exe
1176	winlogon.exe
2032	cute.exe
1608	imoet.exe
1720	imoet.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 1492	1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe	27
PID 1188 wrote to memory of 1492	1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe	27
PID 1188 wrote to memory of 1492	1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe	27
PID 1188 wrote to memory of 1492	1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe	27
PID 1188 wrote to memory of 1052	1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe	28
PID 1188 wrote to memory of 1052	1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe	28
PID 1188 wrote to memory of 1052	1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe	28
PID 1188 wrote to memory of 1052	1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe	28
PID 1492 wrote to memory of 1908	1492	Tiwi.exe	29
PID 1492 wrote to memory of 1908	1492	Tiwi.exe	29
PID 1492 wrote to memory of 1908	1492	Tiwi.exe	29
PID 1492 wrote to memory of 1908	1492	Tiwi.exe	29
PID 1492 wrote to memory of 1764	1492	Tiwi.exe	30
PID 1492 wrote to memory of 1764	1492	Tiwi.exe	30
PID 1492 wrote to memory of 1764	1492	Tiwi.exe	30
PID 1492 wrote to memory of 1764	1492	Tiwi.exe	30
PID 1492 wrote to memory of 888	1492	Tiwi.exe	31
PID 1492 wrote to memory of 888	1492	Tiwi.exe	31
PID 1492 wrote to memory of 888	1492	Tiwi.exe	31
PID 1492 wrote to memory of 888	1492	Tiwi.exe	31
PID 1188 wrote to memory of 1896	1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe	32
PID 1188 wrote to memory of 1896	1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe	32
PID 1188 wrote to memory of 1896	1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe	32
PID 1188 wrote to memory of 1896	1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe	32
PID 1052 wrote to memory of 748	1052	IExplorer.exe	33
PID 1052 wrote to memory of 748	1052	IExplorer.exe	33
PID 1052 wrote to memory of 748	1052	IExplorer.exe	33
PID 1052 wrote to memory of 748	1052	IExplorer.exe	33
PID 1188 wrote to memory of 1140	1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe	34
PID 1188 wrote to memory of 1140	1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe	34
PID 1188 wrote to memory of 1140	1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe	34
PID 1188 wrote to memory of 1140	1188	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe	34
PID 1052 wrote to memory of 1616	1052	IExplorer.exe	35
PID 1052 wrote to memory of 1616	1052	IExplorer.exe	35
PID 1052 wrote to memory of 1616	1052	IExplorer.exe	35
PID 1052 wrote to memory of 1616	1052	IExplorer.exe	35
PID 1492 wrote to memory of 392	1492	Tiwi.exe	36
PID 1492 wrote to memory of 392	1492	Tiwi.exe	36
PID 1492 wrote to memory of 392	1492	Tiwi.exe	36
PID 1492 wrote to memory of 392	1492	Tiwi.exe	36
PID 1052 wrote to memory of 1176	1052	IExplorer.exe	37
PID 1052 wrote to memory of 1176	1052	IExplorer.exe	37
PID 1052 wrote to memory of 1176	1052	IExplorer.exe	37
PID 1052 wrote to memory of 1176	1052	IExplorer.exe	37
PID 1492 wrote to memory of 2032	1492	Tiwi.exe	38
PID 1492 wrote to memory of 2032	1492	Tiwi.exe	38
PID 1492 wrote to memory of 2032	1492	Tiwi.exe	38
PID 1492 wrote to memory of 2032	1492	Tiwi.exe	38
PID 888 wrote to memory of 1096	888	winlogon.exe	39
PID 888 wrote to memory of 1096	888	winlogon.exe	39
PID 888 wrote to memory of 1096	888	winlogon.exe	39
PID 888 wrote to memory of 1096	888	winlogon.exe	39
PID 1052 wrote to memory of 1608	1052	IExplorer.exe	40
PID 1052 wrote to memory of 1608	1052	IExplorer.exe	40
PID 1052 wrote to memory of 1608	1052	IExplorer.exe	40
PID 1052 wrote to memory of 1608	1052	IExplorer.exe	40
PID 1052 wrote to memory of 1720	1052	IExplorer.exe	41
PID 1052 wrote to memory of 1720	1052	IExplorer.exe	41
PID 1052 wrote to memory of 1720	1052	IExplorer.exe	41
PID 1052 wrote to memory of 1720	1052	IExplorer.exe	41

System policy modification 1 TTPs 10 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe

C:\Users\Admin\AppData\Local\Temp\aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe
"C:\Users\Admin\AppData\Local\Temp\aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1188
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1492
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    PID:1908
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1764
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Modifies system executable filetype association
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Disables RegEdit via registry modification
    - Disables cmd.exe use via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies WinLogon
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:888
  - - C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      4⤵
      Executes dropped EXE
      PID:1096
  - - C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      4⤵
      PID:1372
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      4⤵
      PID:1328
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      4⤵
      PID:672
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      4⤵
      PID:1576
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Modifies system executable filetype association
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Disables RegEdit via registry modification
    - Disables cmd.exe use via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies WinLogon
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:392
  - - C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      4⤵
      PID:1904
  - - C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      4⤵
      PID:1160
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      4⤵
      PID:932
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1720
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      4⤵
      PID:1456
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Modifies system executable filetype association
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Disables RegEdit via registry modification
    - Disables cmd.exe use via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies WinLogon
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:2032
  - - C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      4⤵
      PID:836
  - - C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      4⤵
      PID:1764
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      4⤵
      PID:2024
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      4⤵
      PID:1700
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      4⤵
      PID:728
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:748
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1616
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1176
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1608
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    PID:1720
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1896
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1140
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  PID:1872
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  PID:1920
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  PID:944
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  PID:860
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  PID:1312
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  PID:1936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
842d923e2b05ea5f8850cd3d8d21b568

SHA1
51b2ba5f689b2904e9b27bd91f58839e56d4f0d5

SHA256
e3eaed854268e4de1bf427758f323b4e106cc7d866ff9720c04da4db937df629

SHA512
fb4639b2d6e960d3c54ebd509af8c0061088877f7f278170cc364452f55c902c00798f4a6ba86fea75bc0d910930ce895a6f4d997682f99a778544d46b660472

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
c974955d731a057513b20051b3cf13ea

SHA1
d3058f70e8399c4067bbdb5a8d96e5b4ffaecafc

SHA256
1ebecd8587c43406ddf16f0647de71c79c50c9eea08671a078981f87781c532e

SHA512
6b130a08811c5e9b3bcc0de3a8ab09681561cd5177ad6627200a066e9e90bed8db0c36e308e80b03003f921c6dff1abeb3280a2d6202a2d1ed0cc54e1d93a7cf

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
c974955d731a057513b20051b3cf13ea

SHA1
d3058f70e8399c4067bbdb5a8d96e5b4ffaecafc

SHA256
1ebecd8587c43406ddf16f0647de71c79c50c9eea08671a078981f87781c532e

SHA512
6b130a08811c5e9b3bcc0de3a8ab09681561cd5177ad6627200a066e9e90bed8db0c36e308e80b03003f921c6dff1abeb3280a2d6202a2d1ed0cc54e1d93a7cf

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
c974955d731a057513b20051b3cf13ea

SHA1
d3058f70e8399c4067bbdb5a8d96e5b4ffaecafc

SHA256
1ebecd8587c43406ddf16f0647de71c79c50c9eea08671a078981f87781c532e

SHA512
6b130a08811c5e9b3bcc0de3a8ab09681561cd5177ad6627200a066e9e90bed8db0c36e308e80b03003f921c6dff1abeb3280a2d6202a2d1ed0cc54e1d93a7cf

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
ed92f48f7e1c76e5174ba2830dfe6a44

SHA1
b524f16a5071361c70ceac3ca844aa612f86e64a

SHA256
d9d220114912e4647ebf131604507fb1d0b1cd5fb643e5710b455834a9083aac

SHA512
5335f132dc21ca9087cc410d3f57df4ed7d3c298646b9960acfdbd731b839e905fd6269de51ee8b704d2cc98717b90e52fce666c9e31cbc892ee2b1f24ce67c3

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
f1ce0f84a3762349a3960d6a08e74441

SHA1
e4e0412fa3be41141301e5fb1d5f691cbadf3e66

SHA256
38b415cdb38846aff3869c766d0088d3b9908b0f8528609cadec01c93601eba3

SHA512
876a9564950be8ae789b48d8ce3920ec33e19d9acf8bfa568a9c011371ab925192ae306f9dfe97e01c1f6dec863769867b7fbd3f136948d2305806c66566804c

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
5da46045571254a74a0cdaa36248189f

SHA1
f4a6cda4e3a17ae34ff2731832f06a03c04d8c9b

SHA256
2d85443e23d93b6a796c17a87d280abcb52b21ad4438323a88e12d93c642d44b

SHA512
40d0b75ea32a9123b65fff9b1c19318f1fef34f7d914975edf3fab3eec4e6e5c4e07347b47098f11da6f28898ccb1a6159d5966e9dff1c67b6b76d52e21d0a11

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
5da46045571254a74a0cdaa36248189f

SHA1
f4a6cda4e3a17ae34ff2731832f06a03c04d8c9b

SHA256
2d85443e23d93b6a796c17a87d280abcb52b21ad4438323a88e12d93c642d44b

SHA512
40d0b75ea32a9123b65fff9b1c19318f1fef34f7d914975edf3fab3eec4e6e5c4e07347b47098f11da6f28898ccb1a6159d5966e9dff1c67b6b76d52e21d0a11

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
5da46045571254a74a0cdaa36248189f

SHA1
f4a6cda4e3a17ae34ff2731832f06a03c04d8c9b

SHA256
2d85443e23d93b6a796c17a87d280abcb52b21ad4438323a88e12d93c642d44b

SHA512
40d0b75ea32a9123b65fff9b1c19318f1fef34f7d914975edf3fab3eec4e6e5c4e07347b47098f11da6f28898ccb1a6159d5966e9dff1c67b6b76d52e21d0a11

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
25e7d8cea09e5932b8691536c6b80760

SHA1
43be3420b4217cb17539b083c0d0b46ef91e1886

SHA256
a2c7d9d3b9371f6b32f1d78f79572608112931d2e637dbb71a8a86e04c9ce7c8

SHA512
3636f809ccc46f082dedd83f2dedb59b227197bda9c9bb8fc90087ce374ebd88d332735d81e98a91732d3c7b74a1ce1d1dc4f310408bf617bca1c487e39974eb

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
5da46045571254a74a0cdaa36248189f

SHA1
f4a6cda4e3a17ae34ff2731832f06a03c04d8c9b

SHA256
2d85443e23d93b6a796c17a87d280abcb52b21ad4438323a88e12d93c642d44b

SHA512
40d0b75ea32a9123b65fff9b1c19318f1fef34f7d914975edf3fab3eec4e6e5c4e07347b47098f11da6f28898ccb1a6159d5966e9dff1c67b6b76d52e21d0a11

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
5031b49800648ba3fd649be9374e7967

SHA1
8c951f8dfa111994a0ec3215e233cc8b5e782395

SHA256
a0b921b91ca8062e1fe9460da546af8ea1c7c003b418a03da68166f935afde1d

SHA512
ad8093578bae42fac047f5524207215e1ac2be939d6b5c870a433162ce33a09a73ede1513d759ad08ae9c449cebb2766f3897d9e9204737474fe66eb215ab747

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
5031b49800648ba3fd649be9374e7967

SHA1
8c951f8dfa111994a0ec3215e233cc8b5e782395

SHA256
a0b921b91ca8062e1fe9460da546af8ea1c7c003b418a03da68166f935afde1d

SHA512
ad8093578bae42fac047f5524207215e1ac2be939d6b5c870a433162ce33a09a73ede1513d759ad08ae9c449cebb2766f3897d9e9204737474fe66eb215ab747

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
d29bd561bab85c014f120bbbd5b7ec95

SHA1
f3a3a6135d681ee769efc51816277b7ceb3896c8

SHA256
91c659bebfe2fbb10ecc75365daf1dc4535d12e4fb12db21b0e71b06362d8726

SHA512
40479c37c1cc5342f48f24c0b575093753a0ec4e89c0e17f5be64e3b77e06c606d0eb202e28f180571a6445ccf1af64ece261a931bc07d5b91f449c4077f1aeb

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
e497e98a1315f535bfaaefdc8ce8a49f

SHA1
4a181842e72e3b102e02d57208b01b9634b93825

SHA256
ad810e8b3c627a2a579d5deffbcfa0d2221a31d1e07c915f04d7a24b914a36b7

SHA512
c4d4df37541ec980bc6b115ef876d3a6d6cfb345a1dbce4ca0da70297f0f65e8ebb6a0a2fef8d6e40a5d2dfb7a838a8616af9e7cfd868ac28afb3fcfe243a1b5

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
e497e98a1315f535bfaaefdc8ce8a49f

SHA1
4a181842e72e3b102e02d57208b01b9634b93825

SHA256
ad810e8b3c627a2a579d5deffbcfa0d2221a31d1e07c915f04d7a24b914a36b7

SHA512
c4d4df37541ec980bc6b115ef876d3a6d6cfb345a1dbce4ca0da70297f0f65e8ebb6a0a2fef8d6e40a5d2dfb7a838a8616af9e7cfd868ac28afb3fcfe243a1b5

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
a0883f175ba0c5b3e9e340583654dc86

SHA1
197ffda4ee2ff5fce76e3ee30bfc9fd0583b4708

SHA256
aa92267f8b937dcc3b3a0a08ab06348e2fad1635f35eb621e1ef1d79f8f60fc8

SHA512
36a1b2d9a120e17b86b9d9992611fdbefdd9adef08bdb450714bb5e363fa90675a7abb3fc269543273a9fc26ba00b76625f61f13bdc7ecbfd2da754893c23036

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
e497e98a1315f535bfaaefdc8ce8a49f

SHA1
4a181842e72e3b102e02d57208b01b9634b93825

SHA256
ad810e8b3c627a2a579d5deffbcfa0d2221a31d1e07c915f04d7a24b914a36b7

SHA512
c4d4df37541ec980bc6b115ef876d3a6d6cfb345a1dbce4ca0da70297f0f65e8ebb6a0a2fef8d6e40a5d2dfb7a838a8616af9e7cfd868ac28afb3fcfe243a1b5

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe

Filesize
85KB

MD5
c0db43cdd46370d7d2752a985e83abab

SHA1
7203e4ebfafe33dac4ccd6da8f1e21b914be1f96

SHA256
281968a535709b06eadaa6687d35d10dc773c788db1371630bc9be69d955bd49

SHA512
8196c0830d10fd9017aa2767a97b13758c6a392e6040a3ceee06efd844c508f124f55da465061499353d63b0a5ae3d6b35383e3e63c66a407792607a4d07f4e1

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe

Filesize
85KB

MD5
842d923e2b05ea5f8850cd3d8d21b568

SHA1
51b2ba5f689b2904e9b27bd91f58839e56d4f0d5

SHA256
e3eaed854268e4de1bf427758f323b4e106cc7d866ff9720c04da4db937df629

SHA512
fb4639b2d6e960d3c54ebd509af8c0061088877f7f278170cc364452f55c902c00798f4a6ba86fea75bc0d910930ce895a6f4d997682f99a778544d46b660472

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
20d66dbbee836eb8af631cb14fd98db3

SHA1
2cdbbe5eb3958ce378df50848f453ec08ec59d50

SHA256
e9f551629d1acaca733f4668ac5365f4bda531109c6a68b6e79fcb55c4baf6cd

SHA512
1c9387892d6b2760fc1cbd8db7ef782c124f908ccb9d6c0c54475e41d54cc4201010badbe4eb6ce0e9109010f683f85ac7385e63c398d1c8a5f7d4e6f127c304

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
20d66dbbee836eb8af631cb14fd98db3

SHA1
2cdbbe5eb3958ce378df50848f453ec08ec59d50

SHA256
e9f551629d1acaca733f4668ac5365f4bda531109c6a68b6e79fcb55c4baf6cd

SHA512
1c9387892d6b2760fc1cbd8db7ef782c124f908ccb9d6c0c54475e41d54cc4201010badbe4eb6ce0e9109010f683f85ac7385e63c398d1c8a5f7d4e6f127c304

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
20d66dbbee836eb8af631cb14fd98db3

SHA1
2cdbbe5eb3958ce378df50848f453ec08ec59d50

SHA256
e9f551629d1acaca733f4668ac5365f4bda531109c6a68b6e79fcb55c4baf6cd

SHA512
1c9387892d6b2760fc1cbd8db7ef782c124f908ccb9d6c0c54475e41d54cc4201010badbe4eb6ce0e9109010f683f85ac7385e63c398d1c8a5f7d4e6f127c304

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
20d66dbbee836eb8af631cb14fd98db3

SHA1
2cdbbe5eb3958ce378df50848f453ec08ec59d50

SHA256
e9f551629d1acaca733f4668ac5365f4bda531109c6a68b6e79fcb55c4baf6cd

SHA512
1c9387892d6b2760fc1cbd8db7ef782c124f908ccb9d6c0c54475e41d54cc4201010badbe4eb6ce0e9109010f683f85ac7385e63c398d1c8a5f7d4e6f127c304

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
20d66dbbee836eb8af631cb14fd98db3

SHA1
2cdbbe5eb3958ce378df50848f453ec08ec59d50

SHA256
e9f551629d1acaca733f4668ac5365f4bda531109c6a68b6e79fcb55c4baf6cd

SHA512
1c9387892d6b2760fc1cbd8db7ef782c124f908ccb9d6c0c54475e41d54cc4201010badbe4eb6ce0e9109010f683f85ac7385e63c398d1c8a5f7d4e6f127c304

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
27d443fc690cf5c0f52c35c3551497d7

SHA1
46d7bdaf470fb4e91582eca63ac097c2b9277f2f

SHA256
531ce20aaca935495aa5558a1bd9e06c5a8cdec6b4e09281fc2f941d6bb6c2a0

SHA512
15b700e4132e8f9fdeddf391d8feb74cfc0a6ccc4acb3b1694cc685f4ce21b60b85385c5cd63b6512c035b043036eb9f0726e7a51befa5d85703c317d7f0d0a2

Download Submit
C:\Windows\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
e497e98a1315f535bfaaefdc8ce8a49f

SHA1
4a181842e72e3b102e02d57208b01b9634b93825

SHA256
ad810e8b3c627a2a579d5deffbcfa0d2221a31d1e07c915f04d7a24b914a36b7

SHA512
c4d4df37541ec980bc6b115ef876d3a6d6cfb345a1dbce4ca0da70297f0f65e8ebb6a0a2fef8d6e40a5d2dfb7a838a8616af9e7cfd868ac28afb3fcfe243a1b5

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
e497e98a1315f535bfaaefdc8ce8a49f

SHA1
4a181842e72e3b102e02d57208b01b9634b93825

SHA256
ad810e8b3c627a2a579d5deffbcfa0d2221a31d1e07c915f04d7a24b914a36b7

SHA512
c4d4df37541ec980bc6b115ef876d3a6d6cfb345a1dbce4ca0da70297f0f65e8ebb6a0a2fef8d6e40a5d2dfb7a838a8616af9e7cfd868ac28afb3fcfe243a1b5

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
e497e98a1315f535bfaaefdc8ce8a49f

SHA1
4a181842e72e3b102e02d57208b01b9634b93825

SHA256
ad810e8b3c627a2a579d5deffbcfa0d2221a31d1e07c915f04d7a24b914a36b7

SHA512
c4d4df37541ec980bc6b115ef876d3a6d6cfb345a1dbce4ca0da70297f0f65e8ebb6a0a2fef8d6e40a5d2dfb7a838a8616af9e7cfd868ac28afb3fcfe243a1b5

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
0694d487e7ded49228ab5fd034e368e1

SHA1
c4e203112d241b30ca620a3e29857b20052cac7d

SHA256
e69688d1b501f909562c4fb3dbe231c17dc8c84123c37e85d8820fb756394119

SHA512
87e149d327652b73a6acbc43cda1cc4f42270bc84de1b16e353bdcf3203229f078cd0a5bc561e5d86cff4bb8466396c3413b198f8b2cb7fd95b1ede53d81dafb

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
0694d487e7ded49228ab5fd034e368e1

SHA1
c4e203112d241b30ca620a3e29857b20052cac7d

SHA256
e69688d1b501f909562c4fb3dbe231c17dc8c84123c37e85d8820fb756394119

SHA512
87e149d327652b73a6acbc43cda1cc4f42270bc84de1b16e353bdcf3203229f078cd0a5bc561e5d86cff4bb8466396c3413b198f8b2cb7fd95b1ede53d81dafb

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
0694d487e7ded49228ab5fd034e368e1

SHA1
c4e203112d241b30ca620a3e29857b20052cac7d

SHA256
e69688d1b501f909562c4fb3dbe231c17dc8c84123c37e85d8820fb756394119

SHA512
87e149d327652b73a6acbc43cda1cc4f42270bc84de1b16e353bdcf3203229f078cd0a5bc561e5d86cff4bb8466396c3413b198f8b2cb7fd95b1ede53d81dafb

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
0694d487e7ded49228ab5fd034e368e1

SHA1
c4e203112d241b30ca620a3e29857b20052cac7d

SHA256
e69688d1b501f909562c4fb3dbe231c17dc8c84123c37e85d8820fb756394119

SHA512
87e149d327652b73a6acbc43cda1cc4f42270bc84de1b16e353bdcf3203229f078cd0a5bc561e5d86cff4bb8466396c3413b198f8b2cb7fd95b1ede53d81dafb

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
9495eec0a67889a1a7527d383de058d9

SHA1
6581b7c4d3e311aa2bce52aef125937c871f6a3c

SHA256
448f66bd5e90ecfb707cd0925b0289a5219cc0b75323136e56b0b90e17b8659a

SHA512
8194d14de14d2d00bc2efa3eafe77d146a056fe640d6209126ac6aeadb3068240b35b4575dc792f2e3c9a271a65897a0d0deb1aa6622a421195fee340e880a67

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
e7ae8142e2f166aa99bc194cf4d4a783

SHA1
8a96af94e209b4fdd3762a1a05956ab20aa86464

SHA256
04429673bf45c7e88adcf9fef6fb765035089e732849fb7e39049475b2a5890d

SHA512
dbd84624624b33fcb1e5eeae3201baaac08fd4e6161940304ec6e119d98c29cbd6f018f87b136b458ecd0d9fd888b1abcbda7239ccce56621025478ee5da8998

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
e7ae8142e2f166aa99bc194cf4d4a783

SHA1
8a96af94e209b4fdd3762a1a05956ab20aa86464

SHA256
04429673bf45c7e88adcf9fef6fb765035089e732849fb7e39049475b2a5890d

SHA512
dbd84624624b33fcb1e5eeae3201baaac08fd4e6161940304ec6e119d98c29cbd6f018f87b136b458ecd0d9fd888b1abcbda7239ccce56621025478ee5da8998

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
e7ae8142e2f166aa99bc194cf4d4a783

SHA1
8a96af94e209b4fdd3762a1a05956ab20aa86464

SHA256
04429673bf45c7e88adcf9fef6fb765035089e732849fb7e39049475b2a5890d

SHA512
dbd84624624b33fcb1e5eeae3201baaac08fd4e6161940304ec6e119d98c29cbd6f018f87b136b458ecd0d9fd888b1abcbda7239ccce56621025478ee5da8998

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
e7ae8142e2f166aa99bc194cf4d4a783

SHA1
8a96af94e209b4fdd3762a1a05956ab20aa86464

SHA256
04429673bf45c7e88adcf9fef6fb765035089e732849fb7e39049475b2a5890d

SHA512
dbd84624624b33fcb1e5eeae3201baaac08fd4e6161940304ec6e119d98c29cbd6f018f87b136b458ecd0d9fd888b1abcbda7239ccce56621025478ee5da8998

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
e7ae8142e2f166aa99bc194cf4d4a783

SHA1
8a96af94e209b4fdd3762a1a05956ab20aa86464

SHA256
04429673bf45c7e88adcf9fef6fb765035089e732849fb7e39049475b2a5890d

SHA512
dbd84624624b33fcb1e5eeae3201baaac08fd4e6161940304ec6e119d98c29cbd6f018f87b136b458ecd0d9fd888b1abcbda7239ccce56621025478ee5da8998

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
e2c7c57209012f975f3a096eaf4d2793

SHA1
8bc3bab60cb985a796702d8124540de6aa3586d8

SHA256
f17861b26b9328f6b46334d1698afbbf8846fa941347db5ad948d075f4c618dc

SHA512
586b7deceb92bcf7febe72d2476a93a8d3ceccbc00da334b0c51460aa8305dc8beebff8f9946fcd7323af2616085c60402102b08719b6832ef4ac8c3e80820d9

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
27d443fc690cf5c0f52c35c3551497d7

SHA1
46d7bdaf470fb4e91582eca63ac097c2b9277f2f

SHA256
531ce20aaca935495aa5558a1bd9e06c5a8cdec6b4e09281fc2f941d6bb6c2a0

SHA512
15b700e4132e8f9fdeddf391d8feb74cfc0a6ccc4acb3b1694cc685f4ce21b60b85385c5cd63b6512c035b043036eb9f0726e7a51befa5d85703c317d7f0d0a2

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
27d443fc690cf5c0f52c35c3551497d7

SHA1
46d7bdaf470fb4e91582eca63ac097c2b9277f2f

SHA256
531ce20aaca935495aa5558a1bd9e06c5a8cdec6b4e09281fc2f941d6bb6c2a0

SHA512
15b700e4132e8f9fdeddf391d8feb74cfc0a6ccc4acb3b1694cc685f4ce21b60b85385c5cd63b6512c035b043036eb9f0726e7a51befa5d85703c317d7f0d0a2

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
27d443fc690cf5c0f52c35c3551497d7

SHA1
46d7bdaf470fb4e91582eca63ac097c2b9277f2f

SHA256
531ce20aaca935495aa5558a1bd9e06c5a8cdec6b4e09281fc2f941d6bb6c2a0

SHA512
15b700e4132e8f9fdeddf391d8feb74cfc0a6ccc4acb3b1694cc685f4ce21b60b85385c5cd63b6512c035b043036eb9f0726e7a51befa5d85703c317d7f0d0a2

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
27d443fc690cf5c0f52c35c3551497d7

SHA1
46d7bdaf470fb4e91582eca63ac097c2b9277f2f

SHA256
531ce20aaca935495aa5558a1bd9e06c5a8cdec6b4e09281fc2f941d6bb6c2a0

SHA512
15b700e4132e8f9fdeddf391d8feb74cfc0a6ccc4acb3b1694cc685f4ce21b60b85385c5cd63b6512c035b043036eb9f0726e7a51befa5d85703c317d7f0d0a2

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
27d443fc690cf5c0f52c35c3551497d7

SHA1
46d7bdaf470fb4e91582eca63ac097c2b9277f2f

SHA256
531ce20aaca935495aa5558a1bd9e06c5a8cdec6b4e09281fc2f941d6bb6c2a0

SHA512
15b700e4132e8f9fdeddf391d8feb74cfc0a6ccc4acb3b1694cc685f4ce21b60b85385c5cd63b6512c035b043036eb9f0726e7a51befa5d85703c317d7f0d0a2

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
84c1bb95dd3f48282471f3a8702df741

SHA1
d53c8897b0550c135a5116a2916dd0a1adc49012

SHA256
6174df421e278de2cef007bf9635d56d99e855fdbba93212322143a48367a9bf

SHA512
20af9177784a3e63bad90502530d89b6ca856564f0565696778d8df04e34feba7be31e65ae25b7e895fd25b5e84d98a18cda5cd254bec2771e7e9e61bee60c7d

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
84c1bb95dd3f48282471f3a8702df741

SHA1
d53c8897b0550c135a5116a2916dd0a1adc49012

SHA256
6174df421e278de2cef007bf9635d56d99e855fdbba93212322143a48367a9bf

SHA512
20af9177784a3e63bad90502530d89b6ca856564f0565696778d8df04e34feba7be31e65ae25b7e895fd25b5e84d98a18cda5cd254bec2771e7e9e61bee60c7d

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
84c1bb95dd3f48282471f3a8702df741

SHA1
d53c8897b0550c135a5116a2916dd0a1adc49012

SHA256
6174df421e278de2cef007bf9635d56d99e855fdbba93212322143a48367a9bf

SHA512
20af9177784a3e63bad90502530d89b6ca856564f0565696778d8df04e34feba7be31e65ae25b7e895fd25b5e84d98a18cda5cd254bec2771e7e9e61bee60c7d

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
84c1bb95dd3f48282471f3a8702df741

SHA1
d53c8897b0550c135a5116a2916dd0a1adc49012

SHA256
6174df421e278de2cef007bf9635d56d99e855fdbba93212322143a48367a9bf

SHA512
20af9177784a3e63bad90502530d89b6ca856564f0565696778d8df04e34feba7be31e65ae25b7e895fd25b5e84d98a18cda5cd254bec2771e7e9e61bee60c7d

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
27d443fc690cf5c0f52c35c3551497d7

SHA1
46d7bdaf470fb4e91582eca63ac097c2b9277f2f

SHA256
531ce20aaca935495aa5558a1bd9e06c5a8cdec6b4e09281fc2f941d6bb6c2a0

SHA512
15b700e4132e8f9fdeddf391d8feb74cfc0a6ccc4acb3b1694cc685f4ce21b60b85385c5cd63b6512c035b043036eb9f0726e7a51befa5d85703c317d7f0d0a2

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
84c1bb95dd3f48282471f3a8702df741

SHA1
d53c8897b0550c135a5116a2916dd0a1adc49012

SHA256
6174df421e278de2cef007bf9635d56d99e855fdbba93212322143a48367a9bf

SHA512
20af9177784a3e63bad90502530d89b6ca856564f0565696778d8df04e34feba7be31e65ae25b7e895fd25b5e84d98a18cda5cd254bec2771e7e9e61bee60c7d

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
842d923e2b05ea5f8850cd3d8d21b568

SHA1
51b2ba5f689b2904e9b27bd91f58839e56d4f0d5

SHA256
e3eaed854268e4de1bf427758f323b4e106cc7d866ff9720c04da4db937df629

SHA512
fb4639b2d6e960d3c54ebd509af8c0061088877f7f278170cc364452f55c902c00798f4a6ba86fea75bc0d910930ce895a6f4d997682f99a778544d46b660472

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
842d923e2b05ea5f8850cd3d8d21b568

SHA1
51b2ba5f689b2904e9b27bd91f58839e56d4f0d5

SHA256
e3eaed854268e4de1bf427758f323b4e106cc7d866ff9720c04da4db937df629

SHA512
fb4639b2d6e960d3c54ebd509af8c0061088877f7f278170cc364452f55c902c00798f4a6ba86fea75bc0d910930ce895a6f4d997682f99a778544d46b660472

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
e497e98a1315f535bfaaefdc8ce8a49f

SHA1
4a181842e72e3b102e02d57208b01b9634b93825

SHA256
ad810e8b3c627a2a579d5deffbcfa0d2221a31d1e07c915f04d7a24b914a36b7

SHA512
c4d4df37541ec980bc6b115ef876d3a6d6cfb345a1dbce4ca0da70297f0f65e8ebb6a0a2fef8d6e40a5d2dfb7a838a8616af9e7cfd868ac28afb3fcfe243a1b5

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
e497e98a1315f535bfaaefdc8ce8a49f

SHA1
4a181842e72e3b102e02d57208b01b9634b93825

SHA256
ad810e8b3c627a2a579d5deffbcfa0d2221a31d1e07c915f04d7a24b914a36b7

SHA512
c4d4df37541ec980bc6b115ef876d3a6d6cfb345a1dbce4ca0da70297f0f65e8ebb6a0a2fef8d6e40a5d2dfb7a838a8616af9e7cfd868ac28afb3fcfe243a1b5

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
e497e98a1315f535bfaaefdc8ce8a49f

SHA1
4a181842e72e3b102e02d57208b01b9634b93825

SHA256
ad810e8b3c627a2a579d5deffbcfa0d2221a31d1e07c915f04d7a24b914a36b7

SHA512
c4d4df37541ec980bc6b115ef876d3a6d6cfb345a1dbce4ca0da70297f0f65e8ebb6a0a2fef8d6e40a5d2dfb7a838a8616af9e7cfd868ac28afb3fcfe243a1b5

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
e497e98a1315f535bfaaefdc8ce8a49f

SHA1
4a181842e72e3b102e02d57208b01b9634b93825

SHA256
ad810e8b3c627a2a579d5deffbcfa0d2221a31d1e07c915f04d7a24b914a36b7

SHA512
c4d4df37541ec980bc6b115ef876d3a6d6cfb345a1dbce4ca0da70297f0f65e8ebb6a0a2fef8d6e40a5d2dfb7a838a8616af9e7cfd868ac28afb3fcfe243a1b5

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
e497e98a1315f535bfaaefdc8ce8a49f

SHA1
4a181842e72e3b102e02d57208b01b9634b93825

SHA256
ad810e8b3c627a2a579d5deffbcfa0d2221a31d1e07c915f04d7a24b914a36b7

SHA512
c4d4df37541ec980bc6b115ef876d3a6d6cfb345a1dbce4ca0da70297f0f65e8ebb6a0a2fef8d6e40a5d2dfb7a838a8616af9e7cfd868ac28afb3fcfe243a1b5

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
e497e98a1315f535bfaaefdc8ce8a49f

SHA1
4a181842e72e3b102e02d57208b01b9634b93825

SHA256
ad810e8b3c627a2a579d5deffbcfa0d2221a31d1e07c915f04d7a24b914a36b7

SHA512
c4d4df37541ec980bc6b115ef876d3a6d6cfb345a1dbce4ca0da70297f0f65e8ebb6a0a2fef8d6e40a5d2dfb7a838a8616af9e7cfd868ac28afb3fcfe243a1b5

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
e497e98a1315f535bfaaefdc8ce8a49f

SHA1
4a181842e72e3b102e02d57208b01b9634b93825

SHA256
ad810e8b3c627a2a579d5deffbcfa0d2221a31d1e07c915f04d7a24b914a36b7

SHA512
c4d4df37541ec980bc6b115ef876d3a6d6cfb345a1dbce4ca0da70297f0f65e8ebb6a0a2fef8d6e40a5d2dfb7a838a8616af9e7cfd868ac28afb3fcfe243a1b5

Download Submit
memory/392-172-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/392-230-0x00000000006E0000-0x0000000000713000-memory.dmp

Filesize
204KB

Download
memory/392-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/672-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/748-158-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/836-251-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/860-262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/888-207-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/888-210-0x0000000001D60000-0x0000000001D93000-memory.dmp

Filesize
204KB

Download
memory/888-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/888-242-0x0000000001D60000-0x0000000001D93000-memory.dmp

Filesize
204KB

Download
memory/888-255-0x0000000001D60000-0x0000000001D93000-memory.dmp

Filesize
204KB

Download
memory/888-228-0x0000000001D60000-0x0000000001D93000-memory.dmp

Filesize
204KB

Download
memory/888-252-0x0000000001D60000-0x0000000001D93000-memory.dmp

Filesize
204KB

Download
memory/944-236-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/944-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1052-167-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1052-215-0x0000000002D00000-0x0000000002D33000-memory.dmp

Filesize
204KB

Download
memory/1052-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1052-208-0x0000000002BC0000-0x0000000002BF3000-memory.dmp

Filesize
204KB

Download
memory/1096-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1140-171-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1176-179-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1188-214-0x0000000002850000-0x0000000002883000-memory.dmp

Filesize
204KB

Download
memory/1188-87-0x0000000002850000-0x0000000002883000-memory.dmp

Filesize
204KB

Download
memory/1188-241-0x0000000002850000-0x0000000002883000-memory.dmp

Filesize
204KB

Download
memory/1188-57-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1188-240-0x0000000002850000-0x0000000002883000-memory.dmp

Filesize
204KB

Download
memory/1188-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1188-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1188-170-0x0000000002850000-0x0000000002883000-memory.dmp

Filesize
204KB

Download
memory/1188-209-0x0000000002850000-0x0000000002883000-memory.dmp

Filesize
204KB

Download
memory/1188-213-0x0000000002850000-0x0000000002883000-memory.dmp

Filesize
204KB

Download
memory/1188-206-0x0000000002850000-0x0000000002883000-memory.dmp

Filesize
204KB

Download
memory/1328-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1328-231-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1372-211-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1372-226-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1492-204-0x0000000002510000-0x0000000002543000-memory.dmp

Filesize
204KB

Download
memory/1492-205-0x0000000002510000-0x0000000002543000-memory.dmp

Filesize
204KB

Download
memory/1492-143-0x0000000002510000-0x0000000002543000-memory.dmp

Filesize
204KB

Download
memory/1492-216-0x0000000002510000-0x0000000002543000-memory.dmp

Filesize
204KB

Download
memory/1492-91-0x0000000002510000-0x0000000002543000-memory.dmp

Filesize
204KB

Download
memory/1492-168-0x0000000002510000-0x0000000002543000-memory.dmp

Filesize
204KB

Download
memory/1492-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1492-146-0x0000000002510000-0x0000000002543000-memory.dmp

Filesize
204KB

Download
memory/1492-142-0x0000000002510000-0x0000000002543000-memory.dmp

Filesize
204KB

Download
memory/1608-188-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1616-175-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1616-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1720-195-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1720-193-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1764-151-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1764-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1764-92-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1872-201-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1896-159-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1904-253-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1908-84-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1920-212-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1920-239-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2032-229-0x0000000002500000-0x0000000002533000-memory.dmp

Filesize
204KB

Download
memory/2032-227-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2032-254-0x0000000002500000-0x0000000002533000-memory.dmp

Filesize
204KB

Download
memory/2032-191-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download